Smart City IoT Security Governance: A Case Study of City Councils in Scandinavia

Thesis Abstract

Smart City IoT security governance has emerged as a critical challenge for urban administrations deploying pervasive Internet of Things (IoT) infrastructures across Nordic metropolitan regions, where heterogeneous device ecosystems, data privacy expectations, and cross-agency coordination pressures intersect with stringent regulatory environments. This study addresses the gap in empirical understanding of how city councils in Scandinavia govern IoT security at the municipal level, including policy formulation, risk-based prioritization, vendor management, and inter-agency collaboration mechanisms. The aim is to develop an integrated governance framework that identifies actionable practices for strengthening resilience while maintaining service delivery and citizen trust. Specific objectives are to (i) map the current IoT security governance architectures across selected Scandinavian city councils; (ii) examine the alignment between national regulations, EU directives, and municipal security policies; (iii) assess risk assessment methodologies, incident response protocols, and continuity planning; (iv) evaluate stakeholder roles, governance mechanisms, and cross-border coordination among IT, cybersecurity, and urban services units; and (v) propose a parsimonious, context-sensitive model for responsible IoT procurement, deployment, and oversight. The methodological design combines multiple case studies across four major Scandinavian cities (Stockholm, Copenhagen, Oslo, and Helsinki), selected to represent varied municipal scales and IoT maturity levels. A total of 48 semi-structured interviews will be conducted with senior officials from information security, urban development, and procurement departments, complemented by 12 focus groups involving operations staff and 20 privacy/compliance officers. Document analysis will examine 60 policy dossiers, incident reports from the past five years, and procurement records. A mixed-methods approach will integrate qualitative thematic analysis with quantitative assessment of governance maturity using an adapted Security Governance Maturity Model (SGMM). Validity will be enhanced through triangulation, member checking, and inter-coder reliability checks (Cohen’s kappa ? 0.70). Quantitative data will be analyzed with ordinal logistic regression to identify predictors of governance maturity, and cluster analysis will reveal typologies of municipal IoT governance structures. The theoretical lens combines structuration theory to examine how organizational routines shape and are shaped by IoT security practices, and the technology governance framework to interpret policy, procurement, and risk-management decisions. The analysis will also apply the Information Security Governance reference model to map control objectives, risk treatment, and assurance mechanisms. Expected findings include (i) a typology of IoT governance configurations across the cities, (ii) evidence of gaps between national/EU requirements and municipal implementation, particularly in asset management, vulnerability disclosure, and ongoing monitoring, (iii) relationships between governance maturity and incident response effectiveness, and (iv) practical indicators of procurement-induced security risk, including supplier risk management and secure-by-design adoption rates. The study anticipates identifying best practices such as standardized risk assessment workflows, centralized IoT asset registries, federated incident response playbooks, and structured cross-departmental security councils. Contribution to knowledge comprises (a) a nuanced, context-specific governance framework for smart city IoT security at the municipal level, (b) empirical benchmarks for Scandinavian city councils that can inform regional policy alignment and shared procurement standards, and (c) methodological guidance for evaluating public sector IoT governance using a mixed-methods, multi-stakeholder approach. The study concludes with policy and practice recommendations, including the adoption of a municipal IoT security dashboard, enhanced vendor risk management protocols, routine red-teaming exercises for critical urban services, and iterative governance audits aligned with EU cybersecurity resilience criteria. It also suggests avenues for future research on cross-border interoperability, citizen-facing transparency mechanisms, and longitudinal analyses of governance evolution in response to emerging IoT technologies.